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ment 3 Planning

- = . aggregate for all VPN exploitation-enabled systems).

Q4 FY10
Q4 FY11

  

5 Aggregate VPN buffering M system (Assumptions — LPT? T16? U64?)
Q4 FY09 (Risk Reduc ' - 4 VPN Systems Concurrent VPN Flows I System 100 Mbps Aggregate VPN DataI System
Q4 FY10 10 VPN Systems 100 Concurrent VPN Flows I System 100 Mbps Aggregate VPN DataI System

  
 

Q4 FY11 “i Concurrent VPN Flows I System 500 Mbps Aggregate VPN DataI System

> CES recei
(TURMOIL)

> TURMOIL receives VPN ESP packets and decrypts them
using the keys recovered by CES.

> But there are many VPNs that TURMOIL(s) can’t see.
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100 VPN Systems

E packets from passive collection
nd recovers VPN keys.
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 -) Motivation: Leverage TAO

 

> TAO/DNT active implants have a powerful Man-in-

the-Middle capability to access data deep within
target networks.

I They can select packets and exfiltrate them back to the

Common Data Receptor (CDR) at the Remote Operations
Center (ROC).

I HAMMERSTEIN: target any 5-tuple packet

° {Src|P, SrcPort, DstIP, DstPort, Protocol}
I IKE: VPN key exchanges
I ESP: VPN encrypted tunnels

I HAMMERCHANT: target VoIP phone numbers
° Process SIP/H.323 VoIP signaling
0 Forward targeted phone call RTP media sessions

> But CDR has limited input bandwidth.
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Hmmmm-

Maybe... Combine Active & Passive?
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> Motivation: Why?
> TURBULENCE High Level Concept: What?

> Details: How?

I FASHIONCLEFT Exfiltration Protocol
° Definition
° Processing Required

I Turmoil Architecture

I Turmoil Implementation
° Packet Reinjection: Stage 1 Prime
° Packet Processing Framework: AEG/SEG
° Packet Routing: different Transform Engines

I Complexity
I Challenges
> Phased Development
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 (U) TURBULENCE Architecture
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 (U) Sensors: Passive Collection

 

Accesses  (SIISIIIREL) High-speed passive collection
TURMOIL — systems intercept foreign target satellite, microwave,

and cable communications as they transit the globe.
TUTELAGE

Implants (TAO)

Internet
- _ Clam

I  ' m..-
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d- i. . .

Internet
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CE“!

 

 

TOP SECRETHCOMINTNREL TO USA. AUS. CAN. GBR. NZLI120291123

\U I DUI I DU I D . HI: ll V C 1” ISIWMIHIEL TO USA, AUS, CAN, GBR, NZLH20291123

Management

Accesses %
O TURMOIL
. TUTELAGE

Implants (TAO) %

 

 

 

 

 

 

i

m “Internist

I ]I'I'.1.'IIIII'.'1.

[J | I:-

I 

...J. |"I

]|It1".u:IZ-:t ' '.
Curl: 13d I-""

“i

 

TOP SECRETHCOMINTNREL TO USA. AUS. CAN. GBR. NZLh'20291123

    

‘ 'EL1T)USAHIUJS.CA“L<3BR1

20291123

Tasking
' I

5  VoIP server

or VPN

   
  

Tailored Access
Dfﬁcg Remate
,Dperatmns Center

I
I.- ..'"-r.- d
u.
.-

 

 

   

 
 

10

  

 
 

    

Tailored Access
Dfﬁcg Remate
_ ,Dperatmns Center

 

TOP SECRETHCOMINTHREL TO USA, AUS, CAN, GBR, NZLHZOZQIIZ3

 

FASHIONCLEFT Exfiltration Protocol
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FASHIONCLEFT

> Definition: TAO/DNT protocol used by implants to
exfrltrate collected network packets to the Common
Data Receptor (CDR, aka FLAXENPRECEPT).

 

> Provides support for:
I Metadata Authentication/Integrity + AntiRepIay + Encryption
I Data Encryption
I Uses 1024—bit RSA, 128-bit RC6, SHA-l

> Based on DNT standards:
I FOGYNULL (DNT Exfiltration Protocol)
I FUNNELAPS (DNT Exfiltration Data Format)
I SHELLGREY (DNT Exfiltration Metadata Format)
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1 Select packet based on tasking.

2. Make a copy of the selected packet.
3. Modibr packet IP destination address.
4

Modibr other protocol fields (IP, UDP, TCP) as needed
to bypass firewalls and to tag packets for ID.

5. Optionally encrypt/munge Transport layer payload.
6. Send modified Data Packet (DP) to new destination.
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"h. Receiver: Needs Metadata

  

> Metadata explains how to:

Identng an exfil packet and the implant source.

Recover original IP destination address.

Recover other original protocol fields (IP, UDP, TCP).
Contains Key to decrypt/unmunge transport layer payload.

PWN!‘

> Metadata sent in a Session Announcement (SA)
0 SAs is an lP/UDP packet sent to a destination lP/port.
0 Multiple copies of SA sent to mitigate dropped SA packets.

> Receiver is dynamically configured with:

0 SA IP/ports, Infrastructure & Implant Private Keys
0 Processing Mode: Reconstruct or Reinject
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> IP Header
> UDP Header
I SA Payload in UDP Transport Layer

 

 

I Infrastructure Header (128 bytes) Taregpelilﬂgﬂga
° RSA Encrypted w/ Infrastructure Public Key Paggﬁg-SI:Eggflbozm
° Contains SHA-1(INF-HDR), Cryptold Packet-IF-Dam r1
- Cryptold = {Deployment|d, Targetld, Implantld}
I Implant Header (128 bytes) Opﬂos
0 RSA Encrypted w/ Cryptold ’8 Public Key ImLTEE'I'inDﬂm

Encrypt-M ode = 0x02

° Contains SHA-1(IMP-H DR)

° 128-bit CV, MI, and CRC-16 checksum for
Exfil/Metadata Block

w
I Exfil/Metadata Block (variable) MQtSEIZtiﬁ 13'“
° RC6 Encrypted w/ CV & MI
> Minimum packet length = 344 bytes

 

UFOGYNULL

 

FUN NELAPS

W
Exfil-ld = UxDUDDDDeE ML
Exlll-Type — Packet Bytes

Time-oI-lntercept = UxftDO
Filter-Id = Uxi2

 

 

 

 

 

H SHELLGREY n—u
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Look for SA packets:
1) at destIP/destPort; protocol=UDP,
2) that are at least 344 bytes long, and
3) whose first 128-bytes of Transport Payload “look random”.
(Easy/quick initial checks)
1. RSA Decrypt INF-HDR w/ Infrastructure Private Key.
' Authenticate w/ SHA-l

!“

- (Slow secondary check; can’t withstand much non-SA traffic on IP/port)
1. RSA Decrypt IMP-HDR w/ Cryptold '8 Private Key.
' Authenticate w/ SHA-l
1. RC6 Decrypt Exfil/Metadata w/ CV and MI
- Perform CRC-16 integrity check.
. Anti-Replay Check & New Session/Retransmit Check
2. Extract Metadata and create Collection Filter rule for DPS

Metadata contains either 5-tuples or pattern/mask/offset that match DPs
prEvent.cheCF.tuple (5—tuple)
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 FASHIONCLEFT

J Data Packet Processing

 
    

5

, c;

1. Identim an exfil packet that matches DP filter rule.
Modiﬂ to original IP destination address.
Modng to original protocol fields (IP, UDP, TCP).

Decrypt/unmunge transport layer payload.
— Have now recovered the original captured packet.

43.00!“

1. Associate metadata with recovered packet.

— agentCaseNotation, Turmoil link caseNotation
Perform protocol specific processing.

— Pre-selected: forward all traffic to TUBE/PWAVE
— Re-inject back into Turmoil Stage-1

!“
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 TAO Remote Operations Center
..
Common Data Receptor
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— Processing and
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Streaming Packets
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TURMOIL Architecture
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TURMOIL Architecture

 

Crucial for 880 and the .
desire of dynamic What we are currently What we promised to
tasking. focused on 3'30 do for NSA/A&P

    
 
  

   
 

' Stage 4 EL '- a. he"

_-:-"3tage s  a f, ..   .-

  
 
 
 
  
 
 
    

Examines Examines Examines
sequences of sequences of sequences of sequences of
associated associated associated associated
packets sessions applications entities
assessing the assessing the assessing the assessing the
value of their value of their value of their value of their
associated associated associated entities associated
sessions applications (targetslpeople). social network.
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Transform
Engine

  

 

Delay Flow Control
Engine
Delays packets for 3-30
see then drops un-
wanted packets and
sends the rest to
requested Transform
engines
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Bus
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State Engine
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> ' -
* Stateless - does not store data or Publ'Sh Observat'ons

metadata > Each engine can be _specialized and
(Atomic Event Generator = AEG) optimized based on Incoming speed
p Evaluation Oftrafﬁc I Software and/or Hardware

 

      
    

Examples:

1. Detect VPN setup:
IKE key exchange.

2. Detect VPN tunnel:
ESP packets.

3. Detect VolP signaling:
H.323, SIP, Skype, etc.

4. Detect FASHIONCLEFT
Session Announcement.

l Delay Flo r I

 

 

 

 

 

 

   

’l

I State Engine
Aessage "glne

State Engine

    
 
 

 

# Data
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> Receives published events from Event Engines and makes processing
deCISlonS.

> Choreographs activity for data flows (Stateful Event Generator = SEG)
' Correlates multiple published events
' Starts/stops transform processing engines
' Publishes decisions about the flow

> Each State Engine can be specialized and optimized

 

Examples:

1. Associate VPN IKE/ESP
traffic with recovered VPN
keys.

2. Associate VolP signaling
w/ phone call.

3. Track FASHIONCLEFT
SA’s: new, keepalive, replay?

 

 

   

 

 

 

 

 

 

I Sate Engine

# Data
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> Receives orders from State Engines
> Operation applied to a data object that does not change its level of
abstraction.
' Packet-bPacket(s)
' Session 9Session(s)
> Groomed data object can then be re-injected or sent forward

 

Examples:

1. Decompress/decrypt
packet

2. Reconstruct original
packet from
FASHIONCLEFT Data
Packet.
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Technology __
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Stage 1: Packet Processing Stage 2
Stage 1’: Packet Re-Processing
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Packets
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Stage 1: Packet Processing

 

Metadata Processor

 

 

I _ _ i Stagel ASDF
Reporter

'—> ASDF Metadata to Stage 2

IKE

Events to BME I VPN IKE/ESP Metao'ata
to Stage 2

 

 

ESP
Events to BME

 

 

‘l’

 

 

Metao'ata
"-9 NE Metadata : IVE Metao'ata to Stage 2
Tabulator

 

 

 

 

 

 

 

 

 

Atomic Event Events Stateful Event Events Event "Hits"

Generator Generator Filter
(AEG) (SEG) (EF)

 

 

> EF Metao'ata to Stage 2

PPF Engines

_____ __.|______

 

 

 

SECRETNCOMINTH20291123

TOP SECRETHCOMINTHREL T0 USA, AUS, CAN, GBR, NZLII20291123
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Complexity
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> APEX Sequence Diagram
I Tasking
I Look for: FASHIONCLEFT Session Announcements.
I Recognize SA
I Look for: FASHIONCLEFT Data Packets
I Recognize DP
I Route DP to Bundling or Packet Reinjection TE
I Reconstruct, Attach Metadata, Output/Reinject

> VPN Dataflow & Sequence Diagram
I Recognize VPN IKE Packets
I Send a_|| IKE Metadata to CES TOYGRIPPE database
I Send targeted IKE to CES POISON NUT for VPN key recovery.
I Recognize VPN ESP Packets
I Save targeted ESP in big buffer and request VPN key from CES.
I If receive VPN key, decrypt and Reinject.
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Challenges
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 Challenges

’ SIGDEV

I Find target networks/devices with desired traffic.
- TAO/R&T

I Exfiltration path discovery from device to Turmoil.

° COALSHOVEL

   

> End-to-End Metadata & Processing
I Provide CES with appropriate metadata for VPN mission.

I Provide TUBE/PRESSUREWAVE with appropriate
metadata for VoIP analytic.

I Two Case Notations:
0 Link collected by Active Implant: “new” agentCaseNotation
0 Link collected by Passive System: “current” caseNotation.
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_w  Challenges
‘ A
> Classification & Legal Authority
I Some TAO implants/accesses are compartmented.
° The highest priority VPNs are likely on compartmented accesses.
I We’d like to exfil packets to high-bandwidth 880 sites
0 Ensure compliance with FISA / FAA / PAA / USS/D SP0018.

P
n

> Future Automation
I Turbine tasks both Active & Passive collectors
I Automated Path Discovery
I Dynamically task Active system using Passive selectors

° Exfil VoIP signaling to Turmoil for selection:
I task selected calls for exfil.

° Exfil VPN ESP tunnel starts to Turmoil for selection:
I task exploitable tunnels for exfil.

° Apply automated OPSEC policy to manage exfil bandwidth & CPU
utilization on implanted device.
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> Command & Control
> VPN
> VolP
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 APEX Command & Control Phases

> 0810 Phase 1: Manual Configuration (Spin 15)

I HAMMERMILL is configured via existing command interface.
I Simultaneously TURMOIL APEX is provided a configuration file for this HAMMERMILL mission.
I A human is responsible for keeping the two in sync.

> C&C Phase 2: Semi-automatic Configuration

I TURBINE receives mission parameters and automatically configures both the HAMMERMILL
Implant and the TURMOIL APEX components.

I TURBINE-HAMMERMILL interface uses CHIMNEYPOOL RPC commands and requires
HAMMERMILL verSIon 2.5.

' TURBINE-TURMOIL interface uses ISLANDTRANSPORT.

I C&C Phase 3: Dynamic Targeting
TURBINE sets initial configuration as in Phase 2.
I Exfiled traffic is evaluated by TURMOIL components+KEYCARD for selection decisions.
I TURMOIL messages to TURBINE to dynamically target a particular flow through the implant.
I Exam le:
I TpURMOIL receives an IKE key exchange (and possibly a few initial packets)
I TURMOIL evaluates the IP addresses to decide if the VPN being set up corresponds to a target
I If so, TURMOIL message to HAMMERMILL via TURBINE to capture/exfil corresponding ESP traffic.

I This Bhase must be mana ed so that router exfil does not exceed the tolerable bandwidth limits set
by O_ SEC and operationa concerns. TURBINE may need to Implement additional workflows to
monitor and control exfil volume.
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Tasking ICF (Implant Control File)

-;ﬁ::59’ # TEST-APEX-l INFRASTRUCTURE CONFIGURATION FILE

    
 

.E

ICFiNAME TEST-APEX-1

ICF_DTG Wed Jan 28 14:38:59 2009
ICF_INFO Test ICF for Apex Development
IMPLANT_ID 0x0001

IMPLANT_VER 1

TARGETiID 0x00000002

DEPLOYMENT7ID 0x00000003

TARGET,CN TESTTECHNIQUEiTESTHOST
TARGET_IP 10.0.0.1

TARGET_HOST TESTHOST

#

# IMPLANTiLP[1-9] [<Tunne1-Id>:]<ip-address>[:port(s)]
# Tunnel-Id: 1-TCPiRedir, 2-Fashioncleft, 3-HTTPiBTiS, 4-UDPiS
# ./genkey -l 128

IMPLANTiLPl 2:10.1.1.2:10002
IMPLANTiRC67CV1 5366fbe1 7f7a05fd 33d66a6f 3581de48
#

IMPLANT_RSA_INF
RSANAME TEST_APEX_INF_KEY-1
RSAINFO Wed Jan 28 14:38:59 2009, — ./rsagenkey v2.0
RSASIZE 1024
RSAMOD 32
0xdb532e9d, 0x93c792fc, 0x4459fc40, 0x07744c65,
RSAMU 33 ...
RSAPRIV 32 ...
RSAPUB 32 ...
#
IMPLANTﬁRSAiIMP
RSANAME TESTAAPEinMPiKEY-l
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' Tasking XML (FlashHand'e Miss“ Mame”

u4ﬁ:::;’ <?xml version="1.0" encoding="UTF-8"?>

<dci>
<header>
<fullyQualifiedId>
<protocol>
<protocolName>FN</protocolName>
<protocolVersion>2.a</protoc01Version>
</protocol>
<targetId>2</targetId>
<techniqueId>1</techniqueId>
<techniqueVersion>1</techniqueVersion>
<instanceId>0</instance1d>
</fullyQualifiedId>
<configurationVersion>2<lconfigurationVersion>
<revisionDate>2909-01-30T12:19:05.910-05:00</revisionDate>
</header>
<commands>
<command name="fogynu11Controls" identifier="FNic0NTROL">
<parameters>
<parameter name="replayPrevent">1</parameter>
<parameter name="historyLimit">100</parameter>
<parameter name="antiDelay">0</parameter>
<parameter name="timeWindow">1830<lparameter>
</parameters>
</command>
<command name="implantLp" identifier="IMPLANT_LP">
<parameters>
<parameter name="tunnelId">2</parameter>
<parameter name="ip">1a.1.1.2</parameter>
<parameter name="port">10002</parameter>
</parameters>

</command>...
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 Tasking XML (Turbine " 'TX " Turmo“)

a;ﬁ:$59’ <?xml version="1.0" encoding="UTF-8"?>

<task:message schemaVersion=“1.0" xmlns:task="urn://control.exo/TaskingInterface/v1">
<task:taskAdd>
<task:mnguid>09119000-1111-2222-3333-444455556666<ltask:mnguid>
<task:timestamp>2<ltask:timestamp>
<sessionConfigTask>
<taskSecurityMarking classification="TS" coi="c0MINT" disseminationControls="REL"
sCIcontrols="SI" releasableTo="USA AUS CAN GBR NZL" legalAuthority="RAWSIGINT" />

<header> ... </header>
<commands>
<fogynullControls>

<replayPrevent>1<lreplayPrevent>
<historyLimit>100</historyLimit>
<antiDe1ay>0</antiDelay>
<timeWindow>1809<ltimeWindow>

</fogynullControls>

<apexControls>
<taskUuid>00010001-1111-2222-3333-444455556666</taskUuid>
<agentUuid>89010001-1111-2222-3333-444455556666<lagentUuid>
<agentCaseNotation>UA.AAABBBCCCMM1<lagentCaseNotation>
<processingMode>Reinject</processingMode>

</apexControls>

<implantLp>
<tunne1Id>2<ltunnelId>
<ip>10.1.1.2</ip>
<port>10002<lport>

</implantLp>

</command>...
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> VPN Phase 1: IKE Metadata Only (Spin 15)
I IKE packets are exfiled to TURMOIL APEX.
I APEX reconstructs/reinjects IKE packets to the TURMOIL VPN components.

I TURMOIL VPN extracts metadata from each key exchange and sends to the
CES TOYGRIPPE metadata database. This database is used by SIGDEV
analysts to identify potential targets for further explortation.

> VPN Phase 2: Targeted IKE Fonrvarding (Spin 15)
I TURMOIL VPN looks up IKE packet IP addresses in KEYCARD.

I If either IP address is targeted, the key exchange ackets are forwarded to
the CES Attack Orchestrator (POISON NUT) for PN key recovery.

> VPN Phase 3: Static Tasking of ESP
I HAMMERSTEIN receives static tasking to exfil targeted ESP packets.
I APEX reconstructs/reinjects ESP packets to the TURMOIL VPN components.
I TURMOIL VPN requests VPN key from CES and attempts decryption.

> VPN Phase 4: Dynamic Targeting of ESP
I Based on the value returned by KEYCARD, the ESP for a particular VPN may
be targeted as well.

I TURMOIL sends to HAMMERSTEIN Wa TURBINE) the parameters for
capturing the ESP for the targeted VP .
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 APEX VolP Phases

> VolP Phase 1: Static Tasking of VoIP (Spin m)
I

HAMMERCHANT monitors VolP SIP/H.323 signaling and exfiltrates only targeted VolP
RTP sessnons to TURMOIL.

I APEX reconstructs and bundles the voice packets into a file, attaches appropriate
metadata, and delivers to PRESSUREWAVE.

I This triggers a modified VolP analytic to prepare the VolP for corporate delivery.

> VolP Phase 2. VoIP Call Survey
I HAMMERCHANT monitors VolP SIP/H.323 signaling and exfiltrates all call signaling
metadata to TURMOIL.
I APEX inserts call signaling metadata into an ASDF record and publishes it to the
TURMOIL Asdeeporter component for target SIGDEV.

> VolP Phase 3. Dynamic Targeting of VoIP
I HAMMERSTEIN captures/exfils all VolP signaling
I APEX reconstructs/reinjects the signaling to the TURMOIL VolP components.
I TURMOIL VolP extracts call metadata and sends to FASCIA; checks KEYCARD for hits.
I

If called/calling party is targeted for active exfil, then TURMOIL sends to HAMMERSTEIN
(Via TURBINI ) the parameters to capture the targeted RTP sessron.

I Implementation of VoIP Phase 2 and 3 will be driven by mission need.

I Phase 3 levera es all TU RMQIL VolP signalin protocol processors to expand beyond
SIP and H.323 ggag. Skype) Without additional evelopment on the Implan .
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 Performance & Status Metrics

HHS/nmdc-apex: Turmoil Input [2883-88-1? 15:38:47]
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88:88 88:88 88:88 88:88 88:88 88:88 88:88
MHS/nmdc-apex: ﬁpex Sessions [2888-88-1? 15:38:52]
25.8 I _ I _ I _ I I I I 25.8
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Questions?
"go apex"
apex chat room on LINKUP

 

STDP: 832354 & T111, NCSC/C91

 

